PT-2026-3597 · Unknown · Meddream Pacs Premium

Marcin Icewall · Published 2026-01-20 · Updated 2026-01-24 · CVE-2025-53912

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MedDream PACS Premium version 7.3.6.870

Description An arbitrary file read issue exists in the encapsulatedDoc functionality. A specially crafted HTTP request can lead to unauthorized file access. An attacker can send an HTTP request to the encapsulatedDoc endpoint to trigger this issue. The vulnerability allows reading any file on the server.

Recommendations MedDream PACS Premium version 7.3.6.870: As a temporary workaround, consider disabling the encapsulatedDoc endpoint until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2025-53912

Affected Products

Meddream Pacs Premium

References · 8

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2025-2273 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53912 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53912 · Vendor Advisory
• https://twitter.com/TheHackerWire/status/2013660572764840062 · Twitter Post
• https://twitter.com/0dayPublishing/status/2013630426296864899 · Twitter Post
• https://twitter.com/OstorlabSec/status/2015077686494806431 · Twitter Post
• https://twitter.com/CveFindCom/status/2013637487688659130 · Twitter Post
• https://twitter.com/CVEnew/status/2013634357127229548 · Twitter Post